VulnSocial

CVE-2026-33173Disclosure(rubyonrails / rails)

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch rubyonrails rails systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

rubyonrails CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-925

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rails

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 3 classified signals
  • Peaked at 3 mentions on most recent observed day (2026-03-24)
  • 4 total mentions across 2 days

Affected systems

Vendors
rubyonrails
Products
rails

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-03-23: 1Mentions · 2026-03-24: 3Patch / Workaround · 2026-03-23: 1Technical Details · 2026-03-24: 103-2303-24
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-231
Patch1
2026-03-243
Disclosure3
Full discourse4 posts
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-33173 📊 Severity: 5.3 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33173 #CVE-2026-33173 #CVE #Medium #CyberSecurity #InfoSec https://t.co/gm6q1uwinl

    Post summary

    The tweet announces a new medium‑severity CVE (CVE‑2026‑33173) affecting unspecified products, without providing additional technical, exploit, or remediation details.

    0000023
    111 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-33173 Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts … https://www.cve.org/CVERecord?id=CVE-2026-33173 ----- Traducción: CVE-2026-33173 Act… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-33173, a flaw in Rails Active Storage’s DirectUploadsController affecting earlier releases, and links to the official CVE record.

    0000026
    60 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33173 Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts … https://www.cve.org/CVERecord?id=CVE-2026-33173

    Post summary

    The post reports that CVE-2026-33173 exposes a vulnerability in Rails Active Storage’s DirectUploadsController in older versions, but does not provide a PoC, exploit code, or patch.

    00000162
    56.8K followersView on X
  • ダース葱@darthnegi
    Patch

    🚀 Ruby on Rails v7.2.3.1 がリリースされました。 📦 種別: patch ✨ 主な変更点: • Active Support: NumberConverterにおける指数表記を拒否するよう修正（CVE-2026-33176） • Active Support: `SafeBuffer#%` がunsafeステータスを保持するように修正（CVE-2026-33170） • Active Support: NumberToDelimitedConverterのパフォーマンスを改善（CVE-2026-33169） • Action View: タグヘルパーで空の属性名をスキップし、不正なHTML生成を回避（CVE-2026-33168） • Active Storage: DirectUploadControllerでユーザー提供のメタデータをフィルタリング（CVE-2026-33173） • Active Storage: 最大ストリーミングチャンクサイズを設定可能に（CVE-2026-33174） • Active Storage: 範囲リクエストを単一の範囲に制限（CVE-2026-33658） • Active Storage: `DiskService`におけるパストラバーサルを防止（CVE-2026-33195） • Active Storage: `DiskService#delete_prefixed`におけるグロブインジェクションを防止（CVE-2026-33202） ⚠️ 破壊的変更: • `DiskService#delete_prefixed`の変更により、既存のグロブメタ文字展開に依存するコードは動作しなくなります。 🔧 重要な修正: • Active Support: NumberConverterにおける指数表記を拒否するよう修正（CVE-2026-33176） • Active Support: `SafeBuffer#%` がunsafeステータスを保持するように修正（CVE-2026-33170） • Active Support: NumberToDelimitedConverterのパフォーマンスを改善（CVE-2026-33169） • Action View: タグヘルパーで空の属性名をスキップし、不正なHTML生成を回避（CVE-2026-33168） • Active Storage: DirectUploadControllerでユーザー提供のメタデータをフィルタリング（CVE-2026-33173） • Active Storage: 最大ストリーミングチャンクサイズを設定可能に（CVE-2026-33174） • Active Storage: 範囲リクエストを単一の範囲に制限（CVE-2026-33658） • Active Storage: `DiskService`におけるパストラバーサルを防止（CVE-2026-33195） • Active Storage: `DiskService#delete_prefixed`におけるグロブインジェクションを防止（CVE-2026-33202） #GitHub #Release #Ruby on Rails

    Post summary

    Ruby on Rails v7.2.3.1 is released as a patch version fixing a series of CVEs, with specific code changes enumerated but no proof‑of‑concept or exploitation details provided.

    0000036
    2 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apprubyonrailsrails---

Explore more

Back to dashboardrubyonrails CVEsrails vulnerabilities